Browse Source

Adding intval/escape_string + format code + adding comments.

Julio Montoya 10 years ago
parent
commit
a1bb6d4040
1 changed files with 74 additions and 34 deletions
  1. 74 34
      main/inc/lib/sessionmanager.lib.php

+ 74 - 34
main/inc/lib/sessionmanager.lib.php

@@ -16,6 +16,9 @@ class SessionManager
 {
     public static $_debug = false;
 
+    /**
+     *
+     */
     public function __construct()
     {
 
@@ -1536,7 +1539,6 @@ class SessionManager
         $empty_users = true,
         $send_email = false
     ) {
-
         if ($id_session != strval(intval($id_session))) {
             return false;
         }
@@ -1567,7 +1569,13 @@ class SessionManager
             }
         }
 
-
+        $sql = "SELECT id_user FROM $tbl_session_rel_course_rel_user
+                WHERE id_session = '$id_session' AND status = 0";
+        $result = Database::query($sql);
+        $existingUsers = array();
+        while ($row = Database::fetch_array($result)) {
+            $existingUsers[] = $row['id_user'];
+        }
 
         $sql = "SELECT course_code FROM $tbl_session_rel_course
                 WHERE id_session = '$id_session'";
@@ -1992,7 +2000,6 @@ class SessionManager
      */
     public static function update_session_extra_field_value($session_id, $fname, $fvalue = '')
     {
-
         $t_sf = Database::get_main_table(TABLE_MAIN_SESSION_FIELD);
         $t_sfv = Database::get_main_table(TABLE_MAIN_SESSION_FIELD_VALUES);
         $fname = Database::escape_string($fname);
@@ -2231,7 +2238,8 @@ class SessionManager
         }
 
         //Setting session_category_id to 0
-        $sql = "UPDATE $tbl_session SET session_category_id = 0 WHERE session_category_id IN (" . $id_checked . ")";
+        $sql = "UPDATE $tbl_session SET session_category_id = 0
+                WHERE session_category_id IN (" . $id_checked . ")";
         Database::query($sql);
 
         $sql = "SELECT id FROM $tbl_session WHERE session_category_id IN (" . $id_checked . ")";
@@ -2251,21 +2259,29 @@ class SessionManager
 
         // Add event to system log
         $user_id = api_get_user_id();
-        event_system(LOG_SESSION_CATEGORY_DELETE, LOG_SESSION_CATEGORY_ID, $id_checked, api_get_utc_datetime(), $user_id);
+        event_system(
+            LOG_SESSION_CATEGORY_DELETE,
+            LOG_SESSION_CATEGORY_ID,
+            $id_checked,
+            api_get_utc_datetime(),
+            $user_id
+        );
 
         // delete extra session fields where field variable is "PERIODO"
         $t_sf = Database::get_main_table(TABLE_MAIN_SESSION_FIELD);
         $t_sfv = Database::get_main_table(TABLE_MAIN_SESSION_FIELD_VALUES);
 
-        $sql = "SELECT t_sfv.field_id FROM $t_sfv t_sfv, $t_sf t_sf  WHERE t_sfv.session_id = '$id_checked' AND t_sf.field_variable = 'PERIODO' ";
+        $sql = "SELECT t_sfv.field_id FROM $t_sfv t_sfv, $t_sf t_sf
+                WHERE t_sfv.session_id = '$id_checked' AND t_sf.field_variable = 'PERIODO' ";
         $rs_field = Database::query($sql);
 
         $field_id = 0;
         if (Database::num_rows($rs_field) > 0) {
             $row_field = Database::fetch_row($rs_field);
             $field_id = $row_field[0];
-            $sql_delete_sfv = "DELETE FROM $t_sfv WHERE session_id = '$id_checked' AND field_id = '$field_id'";
-            Database::query($sql_delete_sfv);
+            $sql = "DELETE FROM $t_sfv
+                    WHERE session_id = '$id_checked' AND field_id = '$field_id'";
+            Database::query($sql);
         }
 
         $sql = "SELECT * FROM $t_sfv WHERE field_id = '$field_id' ";
@@ -2281,7 +2297,8 @@ class SessionManager
 
     /**
      * Get a list of sessions of which the given conditions match with an = 'cond'
-     * @param  array $conditions a list of condition (example : array('status =' =>STUDENT) or array('s.name LIKE' => "%$needle%")
+     * @param  array $conditions a list of condition example :
+     *  array('status' => STUDENT) or array('s.name LIKE' => "%$needle%")
      * @param  array $order_by a list of fields on which sort
      * @return array An array with all sessions of the platform.
      * @todo   optional course code parameter, optional sorting parameters...
@@ -2335,8 +2352,8 @@ class SessionManager
      */
     public static function get_session_category($id)
     {
-        $id = intval($id);
         $tbl_session_category = Database::get_main_table(TABLE_MAIN_SESSION_CATEGORY);
+        $id = intval($id);
         $sql = "SELECT id, name, date_start, date_end FROM $tbl_session_category WHERE id= $id";
         $result = Database::query($sql);
         $num = Database::num_rows($result);
@@ -2373,8 +2390,12 @@ class SessionManager
      * @param bool  	- optional, if is true the user don't be a coach now, otherwise it'll assign a coach
      * @return bool true if there are affected rows, otherwise false
      */
-    public static function set_coach_to_course_session($user_id, $session_id = 0, $course_code = '', $nocoach = false)
-    {
+    public static function set_coach_to_course_session(
+        $user_id,
+        $session_id = 0,
+        $course_code = '',
+        $nocoach = false
+    ) {
         // Definition of variables
         $user_id = intval($user_id);
 
@@ -2403,12 +2424,14 @@ class SessionManager
         if (Database::num_rows($rs_check_user) > 0) {
             if ($nocoach) {
                 // check if user_id exits int session_rel_user
-                $sql = "SELECT id_user FROM $tbl_session_rel_user WHERE id_session = '$session_id' AND id_user = '$user_id'";
+                $sql = "SELECT id_user FROM $tbl_session_rel_user
+                        WHERE id_session = '$session_id' AND id_user = '$user_id'";
                 $res = Database::query($sql);
 
                 if (Database::num_rows($res) > 0) {
                     // The user don't be a coach now
-                    $sql = "UPDATE $tbl_session_rel_course_rel_user SET status = 0 WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id' ";
+                    $sql = "UPDATE $tbl_session_rel_course_rel_user SET status = 0
+                            WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id' ";
                     Database::query($sql);
                     if (Database::affected_rows() > 0)
                         return true;
@@ -2416,7 +2439,8 @@ class SessionManager
                         return false;
                 } else {
                     // The user don't be a coach now
-                    $sql = "DELETE FROM $tbl_session_rel_course_rel_user WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id' ";
+                    $sql = "DELETE FROM $tbl_session_rel_course_rel_user
+                            WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id' ";
                     Database::query($sql);
                     if (Database::affected_rows() > 0)
                         return true;
@@ -2426,7 +2450,8 @@ class SessionManager
             } else {
                 // Assign user like a coach to course
                 // First check if the user is registered in the course
-                $sql = "SELECT id_user FROM $tbl_session_rel_course_rel_user WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id'";
+                $sql = "SELECT id_user FROM $tbl_session_rel_course_rel_user
+                        WHERE id_session = '$session_id' AND course_code = '$course_code' AND id_user = '$user_id'";
                 $rs_check = Database::query($sql);
 
                 // Then update or insert.
@@ -2440,7 +2465,8 @@ class SessionManager
                         return false;
                     }
                 } else {
-                    $sql = "INSERT INTO $tbl_session_rel_course_rel_user(id_session, course_code, id_user, status) VALUES('$session_id', '$course_code', '$user_id', 2)";
+                    $sql = "INSERT INTO $tbl_session_rel_course_rel_user(id_session, course_code, id_user, status)
+                            VALUES('$session_id', '$course_code', '$user_id', 2)";
                     Database::query($sql);
                     if (Database::affected_rows() > 0) {
                         return true;
@@ -2456,12 +2482,18 @@ class SessionManager
 
     /**
      * Subscribes sessions to human resource manager (Dashboard feature)
-     * @param	int 		Human Resource Manager id
-     * @param	array 		Sessions id
+     * @param array $userInfo Human Resource Manager info
+     * @param array $sessions_list Sessions id
+     * @param bool $sendEmail
+     * @param bool $removeOldConnections
      * @return int
      * */
-    public static function suscribe_sessions_to_hr_manager($userInfo, $sessions_list, $sendEmail = false, $removeOldConnections = true)
-    {
+    public static function suscribe_sessions_to_hr_manager(
+        $userInfo,
+        $sessions_list,
+        $sendEmail = false,
+        $removeOldConnections = true
+    ) {
         // Database Table Definitions
         $tbl_session_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_USER);
         $tbl_session_rel_access_url = Database::get_main_table(TABLE_MAIN_ACCESS_URL_REL_SESSION);
@@ -2647,14 +2679,13 @@ class SessionManager
             $orderCondition = " ORDER BY s.name ";
         }
 
-
         $whereConditions = null;
         $sessionCourseConditions = null;
         $sessionConditions = null;
         $sessionQuery = null;
         $courseSessionQuery = null;
 
-        switch($status) {
+        switch ($status) {
             case DRH:
                 $sessionQuery = "SELECT sru.id_session
                                  FROM
@@ -2741,6 +2772,7 @@ class SessionManager
         }
 
         if (!empty($orderBy)) {
+            $orderBy = Database::escape_string($orderBy);
             $orderBy = "ORDER BY $orderBy";
         } else {
             if (SessionManager::orderCourseIsEnabled()) {
@@ -2861,7 +2893,8 @@ class SessionManager
         $course_name = Database::escape_string($course_name);
 
         // select the courses
-        $sql = "SELECT * FROM $tbl_course c INNER JOIN $tbl_session_rel_course src
+        $sql = "SELECT * FROM $tbl_course c
+                INNER JOIN $tbl_session_rel_course src
                 ON c.code = src.course_code
 		        WHERE src.id_session LIKE '$session_id'";
         if (!empty($course_name)) {
@@ -2888,8 +2921,9 @@ class SessionManager
      */
     public static function getCourseCountBySessionId($session_id, $keyword = null)
     {
-        $tbl_course				= Database::get_main_table(TABLE_MAIN_COURSE);
-        $tbl_session_rel_course	= Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
+        $tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
+        $tbl_session_rel_course = Database::get_main_table(TABLE_MAIN_SESSION_COURSE);
+        $session_id = intval($session_id);
 
         // select the courses
         $sql = "SELECT COUNT(c.code) count
@@ -2915,19 +2949,25 @@ class SessionManager
     }
 
     /**
-     * Get the session id based on the original id and field name in the extra fields. Returns 0 if session was not found
+     * Get the session id based on the original id and field name in the extra fields.
+     * Returns 0 if session was not found
      *
-     * @param string Original session id
-     * @param string Original field name
+     * @param string $original_session_id_value Original session id
+     * @param string $original_session_id_name Original field name
      * @return int Session id
      */
     public static function get_session_id_from_original_id($original_session_id_value, $original_session_id_name)
     {
         $t_sfv = Database::get_main_table(TABLE_MAIN_SESSION_FIELD_VALUES);
         $table_field = Database::get_main_table(TABLE_MAIN_SESSION_FIELD);
+        $original_session_id_value = Database::escape_string($original_session_id_value);
+        $original_session_id_name = Database::escape_string($original_session_id_name);
+
         $sql = "SELECT session_id
                 FROM $table_field sf INNER JOIN $t_sfv sfv ON sfv.field_id=sf.id
-                WHERE field_variable='$original_session_id_name' AND field_value='$original_session_id_value'";
+                WHERE
+                    field_variable='$original_session_id_name' AND
+                    field_value='$original_session_id_value'";
         $res_session = Database::query($sql);
         $row = Database::fetch_object($res_session);
         if ($row) {
@@ -2939,8 +2979,8 @@ class SessionManager
 
     /**
      * Get users by session
-     * @param  int session id
-     * @param	int	filter by status coach = 2
+     * @param  int $id session id
+     * @param	int	$status filter by status coach = 2
      * @return  array a list with an user list
      */
     public static function get_users_by_session($id, $status = null)
@@ -2972,7 +3012,7 @@ class SessionManager
 
     /**
      * The general coach (field: session.id_coach)
-     * @param int user id
+     * @param int $user_id user id
      * @return array
      */
     public static function get_sessions_by_general_coach($user_id)
@@ -2980,7 +3020,7 @@ class SessionManager
         $session_table = Database::get_main_table(TABLE_MAIN_SESSION);
         $user_id = intval($user_id);
 
-        // session where we are general coach
+        // Session where we are general coach
         $sql = "SELECT DISTINCT *
                 FROM $session_table
                 WHERE id_coach = $user_id";